Privacy Policy

1. Introduction

Thea Mondial Travel is committed to protecting the personal information of all clients, partners, and website visitors. This Privacy Policy explains how we collect, use, store, and protect your data in compliance with Uganda's Data Protection and Privacy Act, 2019 (DPPA) and, where applicable to our international clients, the General Data Protection Regulation (GDPR).

We operate as an inbound Destination Management Company (DMC) based in Kampala, Uganda, serving a global clientele. By engaging with our services or website, you agree to the practices described in this policy.

2. Who We Are

3. What Data We Collect

4. How We Use Your Data

We process your personal data for the following purposes:

• Planning, booking, and managing your travel itinerary
• Communicating with you about reservations, confirmations, and logistics
• Sharing necessary information with service partners (lodges, airlines, national park authorities, guides) strictly for fulfilment purposes
• Processing bank transfer payment instructions and maintaining financial records
• Complying with Ugandan legal obligations including tax records and immigration requirements
• Responding to enquiries and providing customer support
• Sending optional newsletter or travel inspiration updates (only where you have opted in)

5. Legal Basis for Processing

Under the DPPA and GDPR (for EU/EEA clients), we process your data on the following lawful bases:

• Contract performance — necessary to deliver the travel services you have requested
• Legal obligation — required to comply with Ugandan law, tax regulations, and immigration authorities
• Legitimate interests — fraud prevention, security, and business administration
• Consent — for optional marketing communications, which you may withdraw at any time

6. How We Share Your Data

We only share your personal data with third parties who are necessary for delivering your travel experience:

• Accommodation providers (lodges, camps, hotels)
• Ground transportation and vehicle operators
• Uganda Wildlife Authority and national park booking offices
• Airlines and charter flight operators
• Visa and permit processing agencies where applicable
• Our banking institution (for verification of payment transfers only)

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

7. International Data Transfers

As a Uganda-based company serving global clients, your data may be transferred internationally. Where personal data of EU/EEA residents is transferred to Uganda, we implement appropriate safeguards including standard contractual clauses and equivalent data protection commitments with our local partners.

8. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this policy:

• Booking and itinerary records: 7 years (in line with Ugandan tax and financial recordkeeping requirements)
• Marketing opt-in records: until withdrawal of consent
• Enquiry correspondence: 2 years from last contact

After the applicable retention period, data is securely deleted or anonymised.

9. Your Rights

Depending on your country of residence, you may have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you
• Right to rectification — request correction of inaccurate information
• Right to erasure — request deletion of your data, subject to legal retention requirements
• Right to object — object to processing based on legitimate interests or for direct marketing
• Right to data portability — receive your data in a portable format (GDPR clients)
• Right to withdraw consent — for any processing based on consent, at any time

To exercise any of these rights, contact us at theamondialtravel@gmail.com. We will respond within 30 days.

10. Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include secure email communications, restricted staff access, and encrypted file storage where applicable.

No internet-based transmission is entirely secure. While we strive to protect your data, we cannot guarantee absolute security.

11. Children's Privacy

Our services are not directed at children under the age of 18 without the involvement of a parent or legal guardian. We do not knowingly collect personal data from minors without parental consent.

12. Changes to This Policy

We may update this Privacy Policy periodically. The effective date at the top of this document will reflect the most recent revision. Material changes will be communicated via email or posted prominently on our website.

13. Contact Us

For any questions, requests, or concerns regarding this Privacy Policy, please contact: